Add routes-based access control